Combo path still gates the 413 context-overflow mapping on stream === true after #4127 #4149

Where

src/oauth/xai.ts lines 47-54 (validateXaiEndpoint), on dev:

const host = parsed.hostname.toLowerCase();
if (parsed.protocol !== "https:" || (host !== "x.ai" && !host.endsWith(".x.ai"))) {
  throw new Error(...);
}
return parsed.toString();

Problem

Two gaps in the endpoint trust check applied to the OIDC discovery response, which is the URL that then receives the refresh_token in a POST body:

1. Suffix-only host match: https://anything.x.ai/token passes. If the discovery document were ever tampered with (or a subdomain compromised), the refresh token would be posted there.
2. new URL() preserves userinfo, and parsed.toString() returns it: https://u:p@auth.x.ai/oauth2/token passes unchanged, and fetch will turn the userinfo into an Authorization header on the request.

Both measured on Node 24.

Fix

Pin to the known auth hosts and reject userinfo:

const TRUSTED = new Set(["auth.x.ai", "accounts.x.ai"]);
if (parsed.protocol !== "https:" || parsed.username || parsed.password || !TRUSTED.has(host)) throw ...;

auth.x.ai is the live issuer per https://auth.x.ai/.well-known/openid-configuration (checked 2026-09-09); accounts.x.ai is the second host the progrok reference implementation allow-lists.

Severity: low (discovery is fetched over TLS from a fixed host), filed as hardening. Found while porting this module into ima2-gen (devlog 260909_grok_native_oauth/001_opencodex_port_spec.md D6).